remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Recommends installing various official Remotion plugins and well-known third-party libraries including zod, mapbox-gl, and @turf/turf. It also includes a guide for downloading the Whisper.cpp binary and language models for audio transcription.- [COMMAND_EXECUTION]: Provides instructions for using the Remotion CLI to run FFmpeg and FFprobe for media processing tasks such as re-encoding, trimming, and metadata inspection.- [DATA_EXFILTRATION]: Contains code patterns for fetching remote assets (Lottie files, images, videos) and data from external APIs. While these involve network requests, they are standard functionalities for the framework and target well-known or developer-specified endpoints.- [PROMPT_INJECTION]: The skill documents patterns for processing external data which creates an indirect prompt injection surface:
  • Ingestion points: Reads data from external media URLs, user-provided metadata, and JSON/SRT subtitle files.
  • Boundary markers: None explicitly defined in the provided snippets.
  • Capability inventory: Uses fetch, CLI-based media tools, and binary-based transcription services.
  • Sanitization: Not demonstrated in the simplified code examples.- [SAFE]: Correctly instructs the user to manage sensitive credentials like Mapbox access tokens by storing them in a .env file rather than hardcoding them in the source code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 06:15 PM